Splunk Search

How to search the total distinct count on two different fields?

jameskerivan
Explorer

Hi,

This is kind of a silly question, but currently my application is logging the session id as two separate fields, Session_id and sessionId. Now sometimes either of the session ids can be NA. I want to find the total unique session id's for my search based on those 2 fields. An example would be like

session_id = 2 sessionId = 2
session_id = NA sessionId = 3
session_id=1 sessionId = NA

So my count would be 4 with counts for {2, NA, 3, 1}

Thanks so much!

0 Karma

chanmi2
Path Finder

Try this:

your search | eval combine_session = session_id.",".sessionID | makemv delim = "," combine_session | stats dc(combine_session), values(combine_session)
0 Karma

justinatpnnl
Communicator

Normally you would use the COALESCE function for this, but if the session_id literally has the string "NA" then that poses a problem.

I would probably attack it like this:

<your search here>
| eval new_session_id  = case(isnum(session_id), session_id, isnum(sessionID), sessionID, 1==1, "NA")
| stats dc(new_session_id)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...